CVE-2023-22468

{"id": "CVE-2023-22468", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-01-26T21:18:12.060", "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8mr2-xf8r-wr8m", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. This vulnerability is patched in versions 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed). As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse."}], "lastModified": "2023-11-07T04:06:57.353", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "140D3326-21AC-459D-8196-E17C9046AE3E", "versionEndExcluding": "2.8.13"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "3DA17871-7ED7-4D68-A46D-D15DC5B3235F"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta10:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "705FE965-0415-4382-8CA1-A19DF3B5EF35"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta11:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "BC6EDCE3-D564-434F-9A7F-D4A6D579F8F7"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta12:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "FB05E54B-9CF6-45A7-8D47-C98DB6D19E7E"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta13:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "03CD1C5E-18F5-4C6D-B92C-C511C8C12D0B"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta14:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "FF4ABB9D-69DF-42D5-AD60-F9CEEC1B6730"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta2:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "7B4DCCF5-E290-4BDA-AAB9-DF362A2EB7B3"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta3:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "3AE1F3A2-8340-4ED7-B943-ACDA9617DF64"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta4:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "5E033AB7-9987-4C30-849F-2495376CA4F2"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta5:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "D87E9338-C7F6-43BA-886F-C30987ADBA1D"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta6:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "E24EB90F-FE81-4746-8741-8DC9346F79C1"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta7:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "D237956F-FC90-467E-A493-24EFDA1A9F2D"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta8:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "F7AA9AB8-AB6F-43E2-B3E5-685EE9BFE7D4"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta9:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "5BC240A1-431E-4A50-88DC-7AC9BC674254"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.0.0:beta15:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "3F85AFD4-D397-4FDB-B762-521BD5FF14C1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}